ARINC 842

This document sets forth guidance for life-cycle management ofpublic/private (i.e., asymmetric) keys that are used to secureinteractions among systems.

The scope of this guidance is not intended to include:

• Any off-board, ground-based systems, including those withwhich aircraft systems and operator-controlled PEDs maycommunicate. Ground-based systems do not have the uniqueconstraints and challenges associated with global, mobile aircraftsystems; therefore, they are expected to reference guidance in ATASpec 42 as applicable to typical IT environments.

• Passenger-owned devices, which are beyond the control of theaircraft operator.

• Operator-controlled PEDs that are treated like passenger-owneddevices.

This document is meant to be a companion to Air TransportAssociation (ATA) Spec 42, which is the work product of the ATADigital Security Working Group (DSWG). ATA Spec 42 specifies adigital identity management framework and standard digitalcertificate profiles recommended for use across the air transportindustry, as well as standard policies governing the issuance anduse of these certificates and the levels of assurance that may beconveyed in a digital identity. This document specificallyaddresses ATA Spec 42 in the context of actual aircraft deploymentby providing guidance to aircraft manufacturers, equipmentsuppliers, and operators on topics including:

The guidance in this document is focused on the medium identityassurance level described in ATA Spec 42. Chapters 3-2-1 and3-6-2(1) of ATA Spec 42 define the concept of “trust” provided byvarious levels of identity assurance, based on factors such as thequality of the identity-proofing process and various technological,personnel, and procedural controls, as outlined in a CertificatePolicy. The medium assurance level provides moderate trust in thebinding of the public key certificate to the subject, and controlson the private key may be moderate or strong depending on whethersoftware or hardware implementations (respectively) are employed.As suggested in Chapter 3-4 of ATA Spec 42, the medium assurancelevel is expected to apply broadly to air transportationapplications; however, selection of the appropriate assurance levelmust be based on a risk assessment, system requirements, andoperational constraints. For cases where low credential assuranceis determined to be acceptable, the guidance in this document maybe tailored to accommodate the lower level.

Edition:

12

Published:

06/11/2012

Number of Pages:

83

File Size:

1 file , 2.3 MB